Error: Partnership failed to activate in AdminUI

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On
• SITEMINDER

Issue/Introduction

 

Using the AdminUI, when trying to activate a Partnership, the browser gets the following error:

  Error activating Partnership.  

Cause

 

The Policy Store data was missing some objects.

The Policy Server logs show:

[28246/-239907984][Tue Sep 22 2015 15:25:33][PartnershipSvcBase.cpp:3112][findActivePropertySection][ERROR][sm-xobfed-01070] Failed to create filter
[28246/-239907984][Tue Sep 22 2015 15:25:33][PartnershipSvcBase.cpp:3144][findActivePropertySection][ERROR][sm-xobfed-00390] Activation check failed
[28246/-239907984][Tue Sep 22 2015 15:25:33][SPPartSvc.cpp:1899][canBeActivated][ERROR][sm-xobfed-01470] canBeActivated failed

The Policy Server traces give more details:

[09/22/2015][15:25:33.460][15:25:33][28246][4055059312][Reference.cpp:439][ReferenceImpl][][][][][][][][][][][][][][][][][][][][][Enter ReferenceImpl]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][Reference.cpp:1278][ReferenceImpl][][][][][][][][][][][][][][][][][][][][][Unable to resolve dictionary reference"CA.SM::SAMLv2SP.KEY_SPID".]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][][ReferenceImpl][][][][][][][][][][][][][][][][][][][][][Exit ReferenceImpl]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][PartnershipSvcBase.cpp:3112][findActivePropertySection][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR: Failed to create filter]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][PartnershipSvcBase.cpp:3144][findActivePropertySection][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR: Activation check failed]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][SPPartSvc.cpp:1899][canBeActivated][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR: canBeActivated failed.]
[09/22/2015][15:25:33.461][15:25:33][28246][4055059312][SPPartSvc.cpp:2365][setActivated][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR: setActivated failed.]

Some data definitions were missing using XPSExplorer based on a standard Policy Store installation to compare.

 

Resolution

Running the following fixed the problem:

1. XPSDDInstall SmMaster.xdd
2. Restart Policy Server

Please note that all operations on Policy Store would need a backup before being able to roll back to a previous stage in case of any error.   

If the above solution does not work, occasionally a few additional steps are necessary:

1. Run XPSSweeper to synchronize all Policy Store objects with Policy Server
2. XPSDDInstall SmMaster.xdd (in some Partnership Federation instances, the objects facing the issue need to be manually deleted and recreated)
3. Run XPSImport smpolicy.xml to ensure all required objects are loaded
4. Restart Policy Server
5. Activate Partnership
   
   

Additional Information

------ Document reference:

- Import the Policy Store Data Definitions:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/upgrading/in-place-upgrade/upgrade-policy-store.html